Millions of Hacking Attempts Spark Global Scramble to Patch Critical PHP Vulnerabilities
- Millions of automated hacking attempts hit global networks on Oct 21 and Oct 22, 2026, as companies and governments scrambled to patch severe vulnerabilities in the widely used...
- The sudden patching campaign exposed how deeply critical infrastructure relies on decades-old computing tools.
- Governments and major corporations across multiple continents suspended online operations as a precautionary measure on Oct 21 and Oct 22.
Millions of automated hacking attempts hit global networks on Oct 21 and Oct 22, 2026, as companies and governments scrambled to patch severe vulnerabilities in the widely used PHP programming language, Reuters reported. The emergency response forced public and corporate institutions across Europe and Asia to pull websites and digital services offline.
The sudden patching campaign exposed how deeply critical infrastructure relies on decades-old computing tools. Cloudflare CEO Matthew Prince wrote on X that exploitation attempts jumped from thousands before public disclosure to millions shortly after patches were released. Microsoft CEO Satya Nadella told an audience in Cologne, Germany, on Oct 22, It was a long day and a long night, I know for all the IT and security folks … I’ve not seen anything like this in a long, long time.
Emergency Shutdowns From Tokyo to Helsinki
Governments and major corporations across multiple continents suspended online operations as a precautionary measure on Oct 21 and Oct 22. In Japan, brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA, and East Japan Railway temporarily halted internet services. The Japanese Ministry of Finance, the Japan Meteorological Agency, and the National Tax Agency also took systems offline.
European institutions joined the defensive shutdown. French telecom Orange suspended access to PHP-based websites and applications across several subsidiaries. Finland’s state IT services provider Valtori cut public web services before gradually lifting blocks to install patches. Valtori director-general Hannu Naumanen stated that restoring services could take days or weeks due to rigorous testing requirements.
Artificial Intelligence Accelerates the Threat
The underlying vulnerabilities had lurked inside the PHP software for years before artificial intelligence uncovered them. PHP developers released urgent fixes on Oct 21 and urged users to update immediately after details leaked prior to patched versions being finalized. Madeline Lawrence, cofounder of Belgian cybersecurity firm Aikido Security, noted that companies were racing against attackers capable of leveraging artificial intelligence to weaponize the flaws.
Amazon and Cloudflare both recorded widespread exploitation attempts following the disclosure. Tencent Cloud urged Chinese clients to update their software without ordering wholesale web closures, while the Chinese Ministry of Industry and Information Technology instructed organizations to inspect systems and upgrade immediately. South Korea raised its private-sector cybersecurity alert level in response to the elevated threat.
Systemic Vulnerabilities Remain Open
While state providers like Finland’s Valtori confirmed that the initial outages stemmed from precautionary blocks rather than actual breaches, the incident highlighted widening cybersecurity strains. Japan recorded more cyber incidents in the first nine months of 2026 than during all of 2025, according to TrendAI data. IT personnel continue verifying patched systems.
